Categories

BitTorrent
Conferences
Direct Revenue
Julie Amero
Myspace
Podcasts
Postbag
The Big Ones
The Fourth Wall
Yapbrowser
Zango

Creative Commons License
All articles licensed
under a Creative
Commons License
.
 








Home | About me | Press | The Fourth Wall | Links

Monday, August 20, 2007

Thanks, but no thanks

I've had a few people email me telling me about a site claiming to do something similar to Block Checker (remember that thing?) Basically, the site asks you to enter your login details (username and password) onto the site, and it'll....tell you who is blocking you.

Wow.

And of course, all of these sites claim 100% that they DEFINITELY won't do anything screwy with your login details afterwards, oh no. Well, the site in question this time round is this thing:

And, as you can see here and here, there's a whole bunch of domains related to this site that all do the same thing: ask for your login credentials, effectively breaking the Live Messenger TOS regarding keeping your login credentials secret. Whoops. They also use the well worn tactic of changing the users login name to something pimping the website URL - to be more accurate:

"(URL goes here) <-- Find out who deleted you from the MSN without noticing it."

Now people's opinions on this may vary, but to me, that's as close to using the network to spam as makes no difference.

Note also the "Scan Now" button - a nice touch, except there is no "scanning", it just re-prompts you to enter your login details.

Their Terms and Conditions are mostly comedy gold:

"ScanMessenger does NOT perform "Pishing" (SIC) and does NOT store passwords or emails. It is not legally or otherwise related to Microsoft Corporation, MSN Messenger, Hotmail, Hotmail Live Messenger or corporate webs owned by Microsoft."

...so, they don't do "Pishing". I don't know whether to be relieved or worried.

From the sign up form on their extra services page (which will send you Email based advertisements ftw):

"CheckMessenger.NET does not assume responsabilities from the incorrect, inappropriate or illegal usage, or from the lack of truth, integrity, update or precision of the information found in the web site's pages or the results provided from them."

Bolded by me for emphasis. Also, HAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHA.

"If any person considers that ScanMessenger violates any current regulations, provision or norm, please CONTACT us before taking any measures that may harm the site."

.....in other words, what we're doing might be violating some random policy somewhere, but we demand you shut your mouth up about it anyway. Shouldn't they have, you know, worked out themselves if they were doing anything contrary to the MSN Live Network TOS before going live? Hi, here's the TOS, you're asking people to do something that might break them, the end. Thanks. If people want to complain about it (or indeed highlight what you do) then they will. Sorry.

However....that's not the end.

Eagle eyed readers may have noticed what can only be described as a choice piece o' booty jiggling around on that screenshot. I wonder whose videos those are?

Yep, all the ads on the site(s) that I can see are Zango ads. Not only that, but the majority are clearly aimed at the, er, older end of the market. Here's some (probably not-safe-for-work) examples (1, 2).

Now, if you want a big ole plate of boobs, fine. Go nuts. But this does rather beg the question, if this site is serving adverts of a more adult nature, why the Hell are people spamming this thing on Teen Websites? Here's some spam, and here's some more. Enjoy your tits, kids!

In fact, here's more spam (scroll down to the last salvo of comments) - one of the spammers leads to a completely empty fake blog thing, the other leads to a page on Fotolog that's been deactivated for being naughty (probably). There seems to be a lot more spam out there regarding this, too.

In my humble opinion, we're increasingly happy to hand over our login details to pretty much anybody these days. From a security perspective, this sort of thing screams out "accident waiting to happen". I wouldn't touch this "service" (or any others like it) with a fifty foot bargepole.

How about you?

Labels:

All Content © Vitalsecurity.org 2006. The content of this site is entirely the opinion of Paperghost, and is in no way endorsed by FaceTime Communications. In other words - have a problem, come see me.